Unrecognized file s...
 
Notifications
Clear all

Unrecognized file system[HPFS/NTFS]

4 Posts
4 Users
0 Likes
5,061 Views
(@ajeet129)
Posts: 16
Active Member
Topic starter
 

I have forensic images which i am trying to extract but when I am mounting in FTK imager they are showing Unrecognized file system[HPFS/NTFS] when i am trying to expand. I was told they are bitlocked but FTK imager doesn't show anywhere where i can use bit locker password. If anyone familiar to this and suggest how to open that would be helpful.

Thanks in advance.

Regards,
Ajeet

 
Posted : 07/05/2017 5:18 am
mrpumba
(@mrpumba)
Posts: 116
Estimable Member
 

I guess the first place to start is checking for EFS in FTK Imager

"To detect encrypted files
1. Do one of the following
Click File > Detect Encryption.
Click the Detect Encryption button on the Toolbar.
The program scans the evidence and notifies you if encrypted files are located. As illustrated in the
figure above, EFS Encrypted files are indicated by a key icon, , in the Evidence Tree."

 
Posted : 07/05/2017 3:07 pm
(@iron_man)
Posts: 1
New Member
 

Ajeet129 Did you find a solution to your problem? What tool did you use to view it? I have a similar issue when viewing an image in FTK Imager version 4.1.1.1. Also, no EFS encryption was detected.

 
Posted : 16/04/2018 11:15 pm
(@shakes6791)
Posts: 4
New Member
 

I have forensic images which i am trying to extract but when I am mounting in FTK imager they are showing Unrecognized file system[HPFS/NTFS] when i am trying to expand. I was told they are bitlocked but FTK imager doesn't show anywhere where i can use bit locker password. If anyone familiar to this and suggest how to open that would be helpful.
Ajeet

Im going to make a couple assumption here and when you say "mount", you are talking about adding a disk image to FTKi. As far as im aware FTKi doesnt support decrypting disk images.

You can verify that it is indeed bitlocker encrypted by checking the header of the volume. Check out this link, https://www.forensicswiki.org/wiki/BitLocker_Disk_Encryption

You should be able to use the mount feature in FTKi to mount the image and then use windows to unlock the volume and create a decrypted image.

 
Posted : 21/05/2018 7:43 pm
Share: